Tor (short for The onion router) is a system intended to enable online anonymity. Tor client software routes Internet traffic through a worldwide volunteer network of servers in order to conceal a user's location or usage from anyone conducting network surveillance or traffic analysis.

learn more… | top users | synonyms

2
votes
3answers
167 views

What are reasons why one shouldn't run Tor at a network level?

I've been considering proxying all web traffic on my network transparently through Tor and dividing up my bandwidth to share with the rest of the Tor network. Practically speaking, what are some of ...
2
votes
2answers
63 views

Can software projects which accept government funding be trusted?

You may know or probably are using TOR client which provides anonymity to the users but how can one be sure they are secure when browsing using this client and its network since its funded by feds? ...
0
votes
1answer
71 views

Is there a way of determining if tor is running on a remote machine?

In most of the companies, IT guys block some sites and by using TOR or other VPNs people walk around these blocks and gain access to blocked content. My question is, assuming TOR is running on ...
1
vote
4answers
131 views

Will the “Tor Browser” maintain a safe & anonymous internet connection over a computer's sleep/standby-and-resume cycle?

Will the "Tor Browser" maintain a safe & anonymous internet connection over a computer's sleep/standby-and-resume cycle? Is it safe to assume that when the computer sleeps the (internet) ...
5
votes
2answers
246 views

Is the connection to Tor hidden services encrypted?

It's possible for Tor exit nodes to sniff traffic on normal websites, unless you connect via SSL/HTTPS. But what about hidden services, they don't seem to support the HTTPS protocol. Can the exit ...
1
vote
2answers
138 views

Downloading through Tor or not Tor?

If I download a file through TOR, will it be any different than if I download a file through a normal internet browser? I've downloaded stuff through TOR but it's always really slow. I was wondering ...
2
votes
1answer
159 views

How to run a tor hidden service from home securely?

Another theoretical question about Tor: Imagine I am running a dissident web site as a hidden service. How can I reduce the chances that I get caught? Assume I am running the server from home, over a ...
4
votes
3answers
153 views

In Tor, what stops the end server from following the breadcrumbs back to their origin?

This would probably require knocking on people's doors, but — couldn't the endpoint ask the exit node what the relay node was, and then ask the relay node what the entry node was, and then ask the ...
27
votes
8answers
5k views

If I visit a HTTPS website when using Tor, is my IP exposed?

HTTPS is an end-to-end encrypted connection. Given this, does the website I am visiting know my original IP? The website is only available over HTTPS (not unencrypted HTTP).
-2
votes
1answer
118 views

Surfing web anonymously on a mac using Firefox SSH and Tor [duplicate]

I want to download and upload to the internet anonymously. I have successfully configured Forefox to access internet through a secure SSH tunnel service (and remote server). I use 'SSH Tunnel Manager' ...
3
votes
2answers
132 views

Tor traffic correlation attacks by global adversaries

I recently came across a paper called "Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries" (Aaron Johnson et al) ... which seems to be saying that adversaries (like the NSA) that ...
1
vote
1answer
119 views

Separating Apache and MySQL over Tor for security, performance, and reliability

I'm trying to set up a hidden web service over the Tor network, and I was thinking of making a configuration where my Apache server and my database server are located on different networks. I know ...
19
votes
4answers
850 views

Can anonymizing techniques make you less anonymous?

There's a recent report in the news of a Harvard student who emailed in a bomb threat so as to postpone year-end exams. According to the report, he carefully covered his tracks using the best ...
3
votes
1answer
498 views

What are the implications of running a TOR non-exit relay node?

Intuitively, running a non-exit TOR node should bring the benefit of plausible deniability that a packet originated from your device. Unlike exit nodes however, you would not have to worry about ...
0
votes
2answers
147 views

Can Tor browser bundle be attacked like this?

When using the Tor browser bundle, you load the check.torproject.org on start. It tells you when there is a security update to downloads, and let's you click a link to get it. The way for users to ...
2
votes
3answers
722 views

How Tor, Privoxy, Vidalia and Polipo are getting together?

I realized that these applications are frequently used together. What is the role of each software in the mission of anonymity and privacy on the web? While I understand Vidalia is a GUI provider, I ...
1
vote
0answers
444 views

Tor alternatives (change IP address often) [closed]

Are there any services that like Tor let you have many IP addresses and change them quite often? PS. The problem with Tor is that they list publicly their exit nodes, so its very simple to detect that ...
0
votes
1answer
811 views

Can I use tor browser to make myself anonomous? [duplicate]

OK, I came across tor browser couple of years ago. Then I have been using tor browser some some reason or another. Normally I use Firefox or Google chrome but if I want to hide my IP then I use tor. ...
2
votes
1answer
292 views

How is a Tor hidden service immune to exit node attacks?

Let me explain with a nifty diagram: IP/RP <-> bunch of Tor clients/node (Tor circuit) <-> Tor hidden service Wouldn't the last Tor client in the circuit knows that the message is for the Tor ...
2
votes
2answers
207 views

Why would Tor not be vulnerable to this easy-sounding attack?

I'm thinking of this attack on Tor, which I'm sure won't work, as it is much too simple. Mr. Blackhat sets up lots of intermediate nodes. However, whenever TCP connections come in, they are given ...
25
votes
2answers
5k views

Best practices for Tor use, in light of released NSA slides

It has been known in the security community that a tool as versatile as Tor is likely the target of intense interest from intelligence agencies. While the FBI has admitted responsibility for a Tor ...
2
votes
1answer
185 views

Torception: An onion within an onion

With the recent takedown of silkroad, I am pondering on how anonymous you actually can be on the Tor Network. Other more legal or moral uses such as anonymity as a right, or avoiding censorship. These ...
16
votes
2answers
2k views

In the SilkRoad takedown, what does it mean “An IP address was leaking” in Tor?

According to the official complaint, on Page 28 they mention: on May 24, 2013, a Silk Road user sent him a private message warning him that "some sort of external IP address" was "leaking" from ...
3
votes
3answers
326 views

Attack on Tor with stolen private keys of main nodes

What could attacker do with stolen private keys of main nodes? Tor is based on 10 main nodes: moria1, tor26, dizum, Tonga, etc. IP Addresses of this nodes hard-coded into client. ./src/or/config.c: ...
4
votes
1answer
408 views

Avoid being implicated in criminal activity when using Tor

What steps does a Tor user need to take to ensure that he or she doesn't become implicated in other Tor users' criminal activity? For example, I recently came across a Tech Republic article by ...
20
votes
2answers
977 views

How does Tor protect against an attacker just running thousands of nodes?

Does Tor have any protection against an adversary simply running a very large number of nodes? Someone with the necessary resources could just run thousands of relay nodes (including exit nodes). If ...
3
votes
1answer
192 views

Encryption key exchange for Tor

I've been studying how Tor works - including the great QA "Why can a Tor exit node decrypt data, but not the entry node?". I understand the concept of onion routing and multiple layers of ...
2
votes
3answers
5k views

Why is JavaScript disabled in the Tor Browser Bundle?

Didn't Tor create a local socks proxy? Why doesn't all the Web traffic go over this local socks proxy and why is JavaScript disabled in the Tor Browser bundle? If you would connect with firefox for ...
0
votes
2answers
2k views

Tor via Python - can the real IP address leak?

I was thinking about how safe it really is to use Tor as a "local proxy" to grab information from webpages anonymously. Is it possible that the real IP address can be seen? On the official Tor ...
0
votes
4answers
438 views

How can i protect myself from tor vulnerablity on windows

Recently I came across an article regarding Tor. According to article there is speculation that the uncovered malware was used by a law enforcement agency to harvest the IP addresses of users ...
18
votes
1answer
1k views

Could someone explain parts of the FBI's Firefox 0-day?

Here is the full Javascript (and related iframes) that the FBI apparently injected into all "Freedom Hosting" pages in the course of their recent takedown. http://pastebin.mozilla.org/2776374 The ...
8
votes
3answers
864 views

Does excluding Tor nodes by country improve privacy? [closed]

Here's the situation: the government of West Nauru is known to run a lot of TOR exit nodes and to collect a lot of data on the traffic, using extra large arithmometers to collate & correlate ...
4
votes
3answers
5k views

Downloading files using Tor

I have the Tor Browser Bundle installed and have been using the Firefox Tor browser. If I attempt to download a file or email attachment I get the following warning I understand that if I download ...
7
votes
3answers
2k views

Detecting Tor proxy by reading request headers

I am a newbie to the field of security. As I was trying to explore more about HTTP request and response headers, I came across this website which provides a detailed analysis of the request header ...
8
votes
4answers
2k views

Tor and regular browser side by side. Does that make sense?

Can I use a Tor browser session and a regular Firefox session side by side without corrupting the security of the Tor session? E.g. when I download a new Eclipse version or when I'm searching for ...
2
votes
1answer
1k views

How can I get the IP address for a ToR Hidden Service (HSP) with a .onion address?

I'd like to find out the IP address of a given .onion address. Is it possible for me to simply assign an exit node (that I control) to my client and just monitor it to determine what IP address ...
4
votes
1answer
128 views

Use Tor when testing on web apps that allow testing & have bounty programs?

When testing live web apps that allow / encourage security research & disclosure should I be routing my traffic through Tor? Is there a good reason not to? Does it imply a certain malicious ...
7
votes
2answers
1k views

Is the fact that Tor's development is largely government funded cause for concern?

In light of recent events, I've been learning more about Tor, and I have a lot of questions. Here's one. Wikipedia's article states; As of 2012, 80% of the Tor Project's $2M annual budget comes ...
2
votes
2answers
490 views

How actually is Tor hidden service hidden from public?

Let's suppose I have a web server X, listening on port N for instance and configured as a Tor hidden service. How and where is implemented its' hiddenness from public access?
26
votes
2answers
2k views

Why can a Tor exit node decrypt data, but not the entry node?

Me -> Node A -> Node B -> Node C -> destination The documentation on Tor always states that only the exit node C can see plain text data. How is this possible without me talking to Node C ...
4
votes
1answer
547 views

TOR detection in network

After I read this link, I tried to understand how they manage detect TOR traffic The most understandable source for me was this paper He is saying TOR trafic can be detected by port, cipher suite ...
1
vote
1answer
704 views

How was Lulzsec caught? [closed]

I saw that the leader connected to IRC without using TOR and they traced their IP address, but the identity of each member was supposed to be unknown to the others. So even if the leader was acting as ...
2
votes
2answers
598 views

Using Tor from behind a Proxy (like Burp Suite)

I am interested in exploring a bit of the darknet, and I was wondering about the feasibility of running a Tor exit node from behind a local proxy like Burp Suite so that I could ID the destination ...
-5
votes
1answer
274 views

Is there a way to get Tor “for free”? (free as in time, not money)

I'm wondering if there's a way to get the functionality for Tor in Firefox (or my general OS) for "free", meaning that I spend 10 minutes setting up part of the functionality to work and skip the ...
3
votes
2answers
2k views

How safe is Tor from MITM/snooping attacks?

I am behind an HTTP proxy, and I frequently tunnel out via an ssh -D SOCKS proxy (I have access to a couple of outside servers which I can tunnel to) when the HTTP proxy causes problems1. Now, this ...
1
vote
2answers
338 views

Is there an anti-proxy detection available?

Sites like Wikipedia and Google (among others) don't let you sign up through a proxy or TOR (at least with Google, you have to provide SMS verification if you sign up through proxy.) Somehow they ...
1
vote
1answer
277 views

Tor traffic seems to be exiting from different Tor exit nodes - is that expected?

I seem to be observing some odd behaviour whilst experimenting with TOR. It's entirely possible this is just my own ignorance as well, in which case I would appreciate some ...
7
votes
4answers
3k views

What are the disadvantages of Tor?

I've just started using Tor recently, and I'm not sure exactly what security issues come with the benefits. What should/shouldn't I be worried about (in both everyday normal-web browsing use, in ...
8
votes
5answers
4k views

Is a Tor router really safer than a proxy?

If I use a Tor router to browse the regular internet that it has to leave the Tor network through an exit node. Apparently the exit node has all the information from the original user it came from on ...
4
votes
1answer
521 views

Could TOR nodes collect IPs and filter them to unmask .onion url IP addresses?

I feel that I generally understand TOR onion routing. From what I understand, the node knows the IP it is receiving data from and the IP it is sending data to. So surely a node can collect the IP ...